Data And Voice from seperate ISP's

[Mubeen]

Hi,

I'm new to Voice routing n switching. I'm given a task to seperate voice and data traffice from Cisco IP Phones and laptops running softphone and route them through different ISP's (ISP 1 for Voice and ISP 2 for DATA)

I'm thinking best approach for this is to create voice and data vlans on all access ports, mark the voice traffic DSCP = EF and then route the packets based on DSCP.

Question 1: If I create voice and data vlans on all access ports, how will switch (2950 with Standard Image) know whic traffic to go through voice vlan and which through data vlan

Question 2: What is the best way to mark voice traffic DSCP = EF, and where to mark it (I do have 3750G on distribution)?

Question 3: ISP 1 goes down, how to failover it to ISP 2. If ISP 2 goes down, currently no backup (working on getting backup for that)

Question 4: have only 2 WAN ports on Cisco 3845, how to terminate 2 ISP's? I've bought HWIC-4ESW to increase WAN ports but found its L2/L3 switch. So have to create SVI's. Not sure how it will be integrated with routers own ports. I'm thinking of applying IOS FW on this router as well

[balaji.bandi]

Here is my suggestions :

Option1 - If the Device is Iphone you can get diffrerent IP address from Data so you can do PBR here to route the traffic

Option2 - if the PC running smart phone,this is bit tricky not end of world, then you need to create a Policy map and PBR to route the traffic.

example reference Guide :

https://www.cisco.com/c/en/us/td/docs/ios/12_2/qos/configuration/guide/fqos_c/qcfpbr.html

Option3 : you can use IP SLA to track the link, if one fails, fail over the traffic to working link.

Options4 : hope your ISP give you Point to Point - IP address. Then configure these port  Point to Point interface.

make sense ?

[Mubeen]

Thank you for the reply, I'm bit confused about traffic from PC with softphone. How to seperate that. For Cisco IP Phone, its easy but how will I seperate voice and data traffic from PC?

[balaji.bandi]

Sample example :

access-list 111 permit ip any any dscp (value)

route-map BB-DSCP

match ip address 111

set ip next-hop x.x.x.x (which ISP you like to send)

[Richard Burts]

The suggestion from BB is to policy route based on DSCP value. But this assumes that the DSCP is correctly marked. As I understand the original post part of that question was about where and how to mark DSCP. And I think it would be particularly difficult to mark DSCP where an IP will generate regular data traffic and softphone traffic. I think a better approach would be to use PBR, as BB is suggesting, but the acl used to evaluate the traffic by protocol port to identify traffic that is using ports associated with phone traffic.

The original poster also asks about failover. Failover for the phone traffic should not be too difficult. I suggest an approach like this:

1) configure a default route with the ISP for data traffic as the next hop.

2) configure PBR for voice traffic, to evaluate traffic for voice ports and set the next hop as the voice ISP, and to use the verify-availability parameter in the set ip next-hop command. (verify-availability will require that you configure something to track access to the voice ISP) If you lose access to the voice ISP then PBR will no longer route the voice traffic and it will use the default route.

Failover for data traffic is a bit more of a challenge. I suggest an approach like this:

1) configure a default route with the ISP for data traffic as the next hop.

2) configure a second default route with the ISP for voice as the next hop and assign a higher administrative distance to this route.

3) configure IP SLA to track access to the data ISP and if it loses access to the data ISP then the original default route is withdrawn and the backup default route is used.

Also note that if data traffic and voice traffic might use either interface then there is a need to configure address translation on both interfaces to translate both types of traffic. (use a route map to control the translation which can match on both an acl and match on an interface).

HTH

Rick

[Mubeen]

I have marked the DSCP and routed the traffic successfully. 

How would I terminate and load balance 4 ISP's in router, as it only have 2 ports.

[balaji.bandi]

Then you need to introduce Switch in between ISP and Router, since router have only 2 ports.

what kind of Loadbalance you looking ?

[Mubeen]

ISP A and ISP B for Voice (both are eachothers failover as well as load balancing based on available traffic)
ISP C and ISP D for Data (both are eachothers failover, No load balancing)

Also for some reason if both ISP C and ISP D goes down, Voice traffic should failover to ISP A with priority for voice

Also how would I do Nat in this case

[Richard Burts]

Glad to know that you are successful in marking DSCP and routing the traffic. In the original post you mention having a HWIC with 4 ports. If you have 2 available ports on the HWIC you could put them into new vlans, configure vlan interfaces for the new vlans, and use them to connect to other ISPs.

HTH

Rick

[balaji.bandi]

bought HWIC-4ESW - Not mentioned that he installed this one ? yes good catch @Richard Burts , you can utilize this modules for your need.

[Mubeen]

I did installed that card but like I mentioned, it do not support NAT. i can terminate the ISP's there but how/where would I do NAT. Furthermore those ports are 10/100 and I have one link of 250 Mbps

[Richard Burts]

You do not need to do nat on the card since the router in which you have the card does support nat. You should be able to do something like

interface vlan 25

ip nat outside

HTH

Rick

[Mubeen]

Okay so I have 2 gig ports, 4 FE ports and 1 SFP, total of 7 interfaces. 

4 ISP's (A, B, C, D)

1 ISP of 250 Mb on SFP port (WAN)

3 ISP's on 3 FE ports (WAN)

1 FE port for Failover

2 Gig ports for two switches (working in failover) going to LAN (Total BW will be 320 Mb and will be trunk so need gig port).

I can Only NAT on Gig ports and SFP port. still confused how I will NAT for 6 ports while haveing only 3 ports supporting NAT.

[balaji.bandi]

can you post the current configruation so we can suggest better.

can you  also tell "1 FE port for Failover" what you means ? do you have HA Setup ?

[Mubeen]

Currently this is all in theory and diagrams, and yes I'm planning HA setup. I had made a diagram with 3 ISP's few days ago, which I'm attaching. Also we have very low budget therefore using EOL / EOS devices.